diff options
| author | Ivan Pravdin <ipravdin.official@gmail.com> | 2025-07-07 20:10:09 -0400 |
|---|---|---|
| committer | Andrew Morton <akpm@linux-foundation.org> | 2025-07-19 19:08:27 -0700 |
| commit | 44acc46d182ff36d40cea69db3875440fab72ba5 (patch) | |
| tree | 64ca2da2b65fbdf8fd96fb931297a2851ca2f751 /fs/ocfs2 | |
| parent | ocfs2/dlm: fix "take a while" typo (diff) | |
| download | linux-44acc46d182ff36d40cea69db3875440fab72ba5.tar.gz linux-44acc46d182ff36d40cea69db3875440fab72ba5.zip | |
ocfs2: avoid NULL pointer dereference in dx_dir_lookup_rec()
When a directory entry is not found, ocfs2_dx_dir_lookup_rec() prints an
error message that unconditionally dereferences the 'rec' pointer.
However, if 'rec' is NULL, this leads to a NULL pointer dereference and a
kernel panic.
Add an explicit check empty extent list to avoid dereferencing NULL
'rec' pointer.
Link: https://lkml.kernel.org/r/20250708001009.372263-1-ipravdin.official@gmail.com
Reported-by: syzbot+20282c1b2184a857ac4c@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/67cd7e29.050a0220.e1a89.0007.GAE@google.com/
Signed-off-by: Ivan Pravdin <ipravdin.official@gmail.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Diffstat (limited to 'fs/ocfs2')
| -rw-r--r-- | fs/ocfs2/dir.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c index 7799f4d16ce9..8c9c4825f984 100644 --- a/fs/ocfs2/dir.c +++ b/fs/ocfs2/dir.c @@ -798,6 +798,14 @@ static int ocfs2_dx_dir_lookup_rec(struct inode *inode, } } + if (le16_to_cpu(el->l_next_free_rec) == 0) { + ret = ocfs2_error(inode->i_sb, + "Inode %lu has empty extent list at depth %u\n", + inode->i_ino, + le16_to_cpu(el->l_tree_depth)); + goto out; + } + found = 0; for (i = le16_to_cpu(el->l_next_free_rec) - 1; i >= 0; i--) { rec = &el->l_recs[i]; |